CVE-2026-48042

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1124

Affected software

Vendor	Product	Versions
envoyproxy	envoy	>= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11

References

https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21Product
https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pvExploit, Vendor Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pvExploit, Vendor Advisory

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-480437.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Fin CVE-2026-480447.5Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1 CVE-2026-480456.5Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained CVE-2026-480469.3Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated aut CVE-2026-480475.9XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 1 CVE-2026-480487.5XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6 CVE-2026-480495.3@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory c CVE-2026-48056.4The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insuff CVE-2026-480508.8Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/CVE-2026-480513.5Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSR CVE-2026-480525.4Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any or CVE-2026-480535.8Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` param